Skip to content

Commit f0d3841

Browse files
aschackmullaschackmull
authored
Merge pull request github#5105 from JLLeitschuh/feat/JLL/depricated_bintray_usage
CWE-1104: Maven POM dependence upon Bintray/JCenter
2 parents cea1049 + 237fefb commit f0d3841

File tree

10 files changed

+203
-13
lines changed

10 files changed

+203
-13
lines changed

‎java/change-notes/2021-02-23-deprecated-jcenter-bintray.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
lgtm,codescanning
2+
* A new query "Depending upon JCenter/Bintray as an artifact repository"
3+
(`java/maven/dependency-upon-bintray`) has been added.
4+
This query finds uses of the deprecated JCenter/Bintray artifact respositories.

‎java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p><a href="https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-chartcenter/">Bintray and JCenter are shutting down on February 1st, 2022</a>.
7+
Relying upon repositories that are deprecated or scheduled to be shutdown can have unintended consequences;
8+
for example, artifacts being resolved from a different artifact server or a total failure of the CI build.</p>
9+
10+
<p>When artifact repositories are left unmaintained for a long period of time, vulnerabilities may emerge.
11+
Theoretically, this could allow attackers to inject malicious code into the artifacts that you are resolving and infect build artifacts
12+
that are being produced. This can be used by attackers to perform a
13+
<a href="https://en.wikipedia.org/wiki/Supply_chain_attack">supply chain attack</a>
14+
against your project's users.
15+
</p>
16+
17+
</overview>
18+
<recommendation>
19+
20+
<p>Always use the canonical repository for resolving your dependencies.</p>
21+
22+
</recommendation>
23+
24+
<example>
25+
26+
<p>The following example shows locations in a Maven POM file where artifact repository upload/download is configured.
27+
The use of Bintray in any of these locations is not advised.
28+
</p>
29+
30+
<sample src="bad-bintray-pom.xml" />
31+
32+
</example>
33+
<references>
34+
<li>
35+
JFrog blog:
36+
<a href="https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-chartcenter/">
37+
Into the Sunset on May 1st: Bintray, JCenter, GoCenter, and ChartCenter
38+
</a>
39+
</li>
40+
41+
<!-- LocalWords: CWE maven dependencies artifact jcenter bintray
42+
-->
43+
44+
</references>
45+
</qhelp>

‎java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/**
2+
* @name Depending upon JCenter/Bintray as an artifact repository
3+
* @description Using a deprecated artifact repository may eventually give attackers access for a supply chain attack.
4+
* @kind problem
5+
* @problem.severity error
6+
* @precision very-high
7+
* @id java/maven/dependency-upon-bintray
8+
* @tags security
9+
* external/cwe/cwe-1104
10+
*/
11+
12+
import java
13+
import semmle.code.xml.MavenPom
14+
15+
predicate isBintrayRepositoryUsage(DeclaredRepository repository) {
16+
repository.getUrl().matches("%.bintray.com%")
17+
}
18+
19+
from DeclaredRepository repository
20+
where isBintrayRepositoryUsage(repository)
21+
select repository,
22+
"Downloading or uploading artifacts to deprecated repository " + repository.getUrl()

‎java/ql/src/Security/CWE/CWE-1104/bad-bintray-pom.xml

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
5+
6+
<modelVersion>4.0.0</modelVersion>
7+
8+
<groupId>com.semmle</groupId>
9+
<artifactId>parent</artifactId>
10+
<version>1.0</version>
11+
<packaging>pom</packaging>
12+
13+
<name>Bintray Usage</name>
14+
<description>An example of using bintray to download and upload dependencies</description>
15+
16+
<distributionManagement>
17+
<repository>
18+
<id>jcenter</id>
19+
<name>JCenter</name>
20+
<!-- BAD! Don't use JCenter -->
21+
<url>https://jcenter.bintray.com</url>
22+
</repository>
23+
<snapshotRepository>
24+
<id>jcenter-snapshots</id>
25+
<name>JCenter</name>
26+
<!-- BAD! Don't use JCenter -->
27+
<url>https://jcenter.bintray.com</url>
28+
</snapshotRepository>
29+
</distributionManagement>
30+
<repositories>
31+
<repository>
32+
<id>jcenter</id>
33+
<name>JCenter</name>
34+
<!-- BAD! Don't use JCenter -->
35+
<url>https://jcenter.bintray.com</url>
36+
</repository>
37+
</repositories>
38+
<repositories>
39+
<repository>
40+
<id>jcenter</id>
41+
<name>JCenter</name>
42+
<!-- BAD! Don't use Bintray -->
43+
<url>https://dl.bintray.com/groovy/maven</url>
44+
</repository>
45+
</repositories>
46+
<pluginRepositories>
47+
<pluginRepository>
48+
<id>jcenter-plugins</id>
49+
<name>JCenter</name>
50+
<!-- BAD! Don't use JCenter -->
51+
<url>https://jcenter.bintray.com</url>
52+
</pluginRepository>
53+
</pluginRepositories>
54+
</project>

‎java/ql/src/Security/CWE/CWE-829/InsecureDependencyResolution.ql

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -15,22 +15,12 @@
1515
import java
1616
import semmle.code.xml.MavenPom
1717

18-
private class DeclaredRepository extends PomElement {
19-
DeclaredRepository() {
20-
this.getName() = "repository" or
21-
this.getName() = "snapshotRepository" or
22-
this.getName() = "pluginRepository"
23-
}
24-
25-
string getUrl() { result = getAChild("url").(PomElement).getValue() }
26-
27-
predicate isInsecureRepositoryUsage() {
28-
getUrl().regexpMatch("(?i)^(http|ftp)://(?!localhost[:/]).*")
29-
}
18+
predicate isInsecureRepositoryUsage(DeclaredRepository repository) {
19+
repository.getUrl().regexpMatch("(?i)^(http|ftp)://(?!localhost[:/]).*")
3020
}
3121

3222
from DeclaredRepository repository
33-
where repository.isInsecureRepositoryUsage()
23+
where isInsecureRepositoryUsage(repository)
3424
select repository,
3525
"Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to/from repository " +
3626
repository.getUrl()

‎java/ql/src/semmle/code/xml/MavenPom.qll

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -368,6 +368,19 @@ class PomProperty extends PomElement {
368368
PomProperty() { getParent() instanceof PomProperties }
369369
}
370370

371+
/**
372+
* An XML element representing any kind of repository declared inside of a Maven POM XML file.
373+
*/
374+
class DeclaredRepository extends PomElement {
375+
DeclaredRepository() { this.getName() = ["repository", "snapshotRepository", "pluginRepository"] }
376+
377+
/**
378+
* Gets the url for this repository. If the `url` tag is present, this will
379+
* be the string contents of that tag.
380+
*/
381+
string getUrl() { result = getAChild("url").(PomElement).getValue() }
382+
}
383+
371384
/**
372385
* A folder that represents a local Maven repository using the standard layout. Any folder called
373386
* "repository" with a parent name ".m2" is considered to be a Maven repository.

‎java/ql/test/query-tests/security/CWE-1104/semmle/tests/A.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
public class A {
2+
}

‎java/ql/test/query-tests/security/CWE-1104/semmle/tests/MavenPomDependsOnBintray.expected

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
| bad-bintray-pom.xml:17:9:22:22 | repository | Downloading or uploading artifacts to deprecated repository https://jcenter.bintray.com |
2+
| bad-bintray-pom.xml:23:9:28:30 | snapshotRepository | Downloading or uploading artifacts to deprecated repository https://jcenter.bintray.com |
3+
| bad-bintray-pom.xml:31:9:36:22 | repository | Downloading or uploading artifacts to deprecated repository https://jcenter.bintray.com |
4+
| bad-bintray-pom.xml:39:9:44:22 | repository | Downloading or uploading artifacts to deprecated repository https://dl.bintray.com/groovy/maven |
5+
| bad-bintray-pom.xml:47:9:52:28 | pluginRepository | Downloading or uploading artifacts to deprecated repository https://jcenter.bintray.com |

‎java/ql/test/query-tests/security/CWE-1104/semmle/tests/MavenPomDependsOnBintray.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE/CWE-1104/MavenPomDependsOnBintray.ql

‎java/ql/test/query-tests/security/CWE-1104/semmle/tests/bad-bintray-pom.xml

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
5+
6+
<modelVersion>4.0.0</modelVersion>
7+
8+
<groupId>com.semmle</groupId>
9+
<artifactId>parent</artifactId>
10+
<version>1.0</version>
11+
<packaging>pom</packaging>
12+
13+
<name>Bintray Usage Testing</name>
14+
<description>An example of using bintray as a repository</description>
15+
16+
<distributionManagement>
17+
<repository>
18+
<id>jcenter</id>
19+
<name>JCenter</name>
20+
<!-- BAD! Don't use JCenter -->
21+
<url>https://jcenter.bintray.com</url>
22+
</repository>
23+
<snapshotRepository>
24+
<id>jcenter-snapshots</id>
25+
<name>JCenter</name>
26+
<!-- BAD! Don't use JCenter -->
27+
<url>https://jcenter.bintray.com</url>
28+
</snapshotRepository>
29+
</distributionManagement>
30+
<repositories>
31+
<repository>
32+
<id>jcenter</id>
33+
<name>JCenter</name>
34+
<!-- BAD! Don't use JCenter -->
35+
<url>https://jcenter.bintray.com</url>
36+
</repository>
37+
</repositories>
38+
<repositories>
39+
<repository>
40+
<id>jcenter</id>
41+
<name>JCenter</name>
42+
<!-- BAD! Don't use Bintray -->
43+
<url>https://dl.bintray.com/groovy/maven</url>
44+
</repository>
45+
</repositories>
46+
<pluginRepositories>
47+
<pluginRepository>
48+
<id>jcenter-plugins</id>
49+
<name>JCenter</name>
50+
<!-- BAD! Don't use JCenter -->
51+
<url>https://jcenter.bintray.com</url>
52+
</pluginRepository>
53+
</pluginRepositories>
54+
</project>

0 commit comments

Comments
 (0)